RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-20 12:40:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: ssl/cli: 'show ssl cert' escape the first '*' of a filename

Browse Source 
When doing a 'show ssl cert <filename>', prefixing a filename with a '*'
allows to show the uncommited transaction asociated to this filename.

However for people using '*' as the first character of their filename,
there is no way to access this filename.

This patch fixes the problem by allowing to escape the first character
with \.

This should be backported in every stable branches.
This commit is contained in:
William Lallemand 2024-12-16 16:09:38 +01:00
parent fd35b7fb97
commit 2ba4cf541b
2 changed files with 21 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
doc/management.txt
View File

@ -3572,14 +3572,15 @@ show ssl ca-file [<cafile>[:<index>]]
Serial: 587A1CE5ED855040A0C82BF255FF300ADB7C8136
[...]
show ssl cert [<filename>]
show ssl cert [[*][\]<filename>]
Display the list of certificates loaded into the process. They are not used
by any frontend or backend until their status is "Used".
If a filename is prefixed by an asterisk, it is a transaction which is not
committed yet. If a filename is specified, it will show details about the
certificate. This command can be useful to check if a certificate was well
updated. You can also display details on a transaction by prefixing the
filename by an asterisk.
filename by a '*'. If the first character of the filename is a '*', it can be
escaped with '\*'.
This command can also be used to display the details of a certificate's OCSP
response by suffixing the filename with a ".ocsp" extension. It works for
committed certificates as well as for ongoing transactions. On a committed
@ -3611,6 +3612,11 @@ show ssl cert [<filename>]
Status: Unused
[...]
$ echo "@1 show ssl cert \*.local.pem" | socat /var/run/haproxy.master -
Filename: *.local.pem
Status: Used
[...]
show ssl crl-file [<crlfile>[:<index>]]
Display the list of CRL files loaded into the process. They are not used
by any frontend or backend until their status is "Used".

16
src/ssl_ckch.c
View File

@ -2203,7 +2203,7 @@ yield:
#endif
}
/* parsing function for 'show ssl cert [certfile]' */
/* parsing function for 'show ssl cert [[*][\]<certfile>]' */
static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx, void *private)
{
struct show_cert_ctx *ctx = applet_reserve_svcctx(appctx, sizeof(*ctx));
@ -2232,17 +2232,27 @@ static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx
}
if (*args[3] == '*') {
char *filename = args[3]+1;
from_transaction = 1;
if (!ckchs_transaction.new_ckchs)
goto error;
ckchs = ckchs_transaction.new_ckchs;
if (strcmp(args[3] + 1, ckchs->path) != 0)
if (filename[0] == '\\')
filename++;
if (strcmp(filename, ckchs->path) != 0)
goto error;
} else {
if ((ckchs = ckchs_lookup(args[3])) == NULL)
char *filename = args[3];
if (filename[0] == '\\')
filename++;
if ((ckchs = ckchs_lookup(filename)) == NULL)
goto error;
}